Remove unused response bodies from a number of API endpoints.

This removes the response body from the following methods:

* `POST /api/setup`
* `POST /api/auth/login`
* `POST /api/invite/:id`
* `POST /api/password`

The bodies returned from these methods were something of a rough guess as to what might be useful. Actual client development has shown that we don't use _any_ of the data from any of these API responses, so let's not tie ourselves to future compatibility by continuing to send them. We can add a body to a bodyless method a _lot_ more easily than we can change the body of a method that already returns one, after all.

These changes are not backwards compatible for clients which care about the existing bodies. To my knowledge, there are no such clients; the included client definitely doesn't care.

## Internals

Not only does this change stop returning bodies at the API surface, but it also stops retrieving and returning values used internally to construct those responses, simplifying the code a bit in the process.

One side effect of this is that tests that need to log in a user now need to manually verify the returned token secret, to convert it back into a user, whereas the previous versions returned both a token secret and a user during password login. I don't love the increase in the size of the tests, but I think it's the right tradeoff (and this change is code net-negative anyways).

Merges no-content into main.

2 files changed, 18 insertions, 3 deletions

diff --git a/src/event/handlers/stream/test/invite.rs b/src/event/handlers/stream/test/invite.rs
index 01372ce..f2d6950 100644
--- a/src/event/handlers/stream/test/invite.rs
+++ b/src/event/handlers/stream/test/invite.rs
@@ -28,11 +28,16 @@ async fn accepting_invite() {
     // Accept the invite
 
     let (name, password) = fixtures::user::propose();
-    let (joiner, _) = app
+    let joiner = app
         .invites()
         .accept(&invite.id, &name, &password, &fixtures::now())
         .await
         .expect("accepting an invite succeeds");
+    let (_, joiner) = app
+        .tokens()
+        .validate(&joiner, &fixtures::now())
+        .await
+        .expect("a newly-issued secret is valid");
 
     // Expect a login created event
 
@@ -57,11 +62,16 @@ async fn previously_accepted_invite() {
     // Accept the invite
 
     let (name, password) = fixtures::user::propose();
-    let (joiner, _) = app
+    let joiner = app
         .invites()
         .accept(&invite.id, &name, &password, &fixtures::now())
         .await
         .expect("accepting an invite succeeds");
+    let (_, joiner) = app
+        .tokens()
+        .validate(&joiner, &fixtures::now())
+        .await
+        .expect("a newly-issued secret is valid");
 
     // Subscribe
 
diff --git a/src/event/handlers/stream/test/setup.rs b/src/event/handlers/stream/test/setup.rs
index 992b962..297162e 100644
--- a/src/event/handlers/stream/test/setup.rs
+++ b/src/event/handlers/stream/test/setup.rs
@@ -17,11 +17,16 @@ async fn previously_completed() {
     // Complete initial setup
 
     let (name, password) = fixtures::user::propose();
-    let (owner, _) = app
+    let secret = app
         .setup()
         .initial(&name, &password, &fixtures::now())
         .await
         .expect("initial setup in an empty app succeeds");
+    let (_, owner) = app
+        .tokens()
+        .validate(&secret, &fixtures::now())
+        .await
+        .expect("secret returned by initial setup should be valid");
 
     // Subscribe to events